Word/IT chaps - can I check for certain the date a Word file was created?
Thread Starter
Red On, Green On
Joined: May 2004
Posts: 6,490
Likes: 2
From: Between the woods and the water
Word/IT chaps - can I check for certain the date a Word file was created?
I need to check for certain the date a Word file was created - not the time it was last edited.
It's come from a PA in a large public-service organisation, so it's fair to assume that it has not been doctored.
When I look at Properties -> Statistics it says "Created: 07 January 2010", yet the date on the letter says 08 Dec 2009. The posted copy of the letter never arrived, and I'm starting to wonder if it was actually done at the time, or if someone is attempting to cover their tracks? Remarkably the creation date of the letter coincides exactly with the date I complained that I had not received a reply.
Thoughts, please.
It's come from a PA in a large public-service organisation, so it's fair to assume that it has not been doctored.
When I look at Properties -> Statistics it says "Created: 07 January 2010", yet the date on the letter says 08 Dec 2009. The posted copy of the letter never arrived, and I'm starting to wonder if it was actually done at the time, or if someone is attempting to cover their tracks? Remarkably the creation date of the letter coincides exactly with the date I complained that I had not received a reply.
Thoughts, please.
Joined: May 2001
Posts: 10,804
Likes: 1
Some daft bint is attempting to cover her tracks.
Proper IT savy PA's will mess with the system clock so the creation date will be correct then stick a footer on it saying dupicate copy.
As a note to yourself don't send word docs back. It is very easy to tamper with them. Always send PDF files and create you own reference numbering system for all correspondance. eg gas/2010/0119 or gas/2010/001 and always ref to that when you refer to a previous letter. It will ring warning bells that a lawyer has told you the system for a complaint to there regulator.
Proper IT savy PA's will mess with the system clock so the creation date will be correct then stick a footer on it saying dupicate copy.
As a note to yourself don't send word docs back. It is very easy to tamper with them. Always send PDF files and create you own reference numbering system for all correspondance. eg gas/2010/0119 or gas/2010/001 and always ref to that when you refer to a previous letter. It will ring warning bells that a lawyer has told you the system for a complaint to there regulator.
Joined: Aug 2002
Posts: 3,663
Likes: 0
From: Earth
If you want to have some extra fun, you could also try a metadata viewer.
e.g. Pinpoint Labs - Computer Forensics Software and Services
(note i have not used the software above, so the link is not a recommendation, found it via GooGoo search for "word metadata viewer" - without quote marks)
e.g. Pinpoint Labs - Computer Forensics Software and Services
(note i have not used the software above, so the link is not a recommendation, found it via GooGoo search for "word metadata viewer" - without quote marks)
Thread Starter
Red On, Green On
Joined: May 2004
Posts: 6,490
Likes: 2
From: Between the woods and the water
If you want to have some extra fun, you could also try a metadata viewer.
Administrator
Joined: Mar 2001
Aviation Qualifications: PPL
Posts: 8,121
Likes: 686
From: Twickenham, home of rugby
It seems to vary, depending on how the original file was constructed, as to whether the creation date is retained across "importing" the document from an email attachment.
If you open the attachment from within the email, you should be able to see the original statistics, as you haven't saved the file - at least this is true for OE.
Even if the creation date is the date you saved the file, you should still see the Last Printed time.
Bear in mind that the information can be highly misleading - if someone takes an existing document, Saves As and effectively creates a new document from that rather than using a template to create a new doc, the stats can be months or years out!
SD
If you open the attachment from within the email, you should be able to see the original statistics, as you haven't saved the file - at least this is true for OE.
Even if the creation date is the date you saved the file, you should still see the Last Printed time.
Bear in mind that the information can be highly misleading - if someone takes an existing document, Saves As and effectively creates a new document from that rather than using a template to create a new doc, the stats can be months or years out!
SD
Joined: Aug 2002
Posts: 3,663
Likes: 0
From: Earth
Received the file as an attachment into Outlook 2002 SP3 version 10.xxxx
Hopefully the file should then be saved with its original date.
Thread Starter
Red On, Green On
Joined: May 2004
Posts: 6,490
Likes: 2
From: Between the woods and the water
Hopefully the file should then be saved with its original date.
Thread Starter
Red On, Green On
Joined: May 2004
Posts: 6,490
Likes: 2
From: Between the woods and the water
Apols for replying to my own reply, but it just got odder still.
I asked the secretary to a lesser, but still quite important person in the same organisation to send by email a copy of the letter that her boss said had been sent out, which mysteriously had also not arrived before Christmas.
The letter is dated 18 Dec, but the file was created at 10.04 this morning. The other "odd" letter was dated 8 Dec, but the file created on 7 Jan. I did not receive that by email until last week.
Is there any possibility that the sending organisation's IT system is causing this apparent case of @rse-covering, or are these two both telling porkies? What does seems possible is that they have copied them from say a network drive to a local drive, and that has given the file a new creation date.
Neither letter arrived by snail-mail.
I asked the secretary to a lesser, but still quite important person in the same organisation to send by email a copy of the letter that her boss said had been sent out, which mysteriously had also not arrived before Christmas.
The letter is dated 18 Dec, but the file was created at 10.04 this morning. The other "odd" letter was dated 8 Dec, but the file created on 7 Jan. I did not receive that by email until last week.
Is there any possibility that the sending organisation's IT system is causing this apparent case of @rse-covering, or are these two both telling porkies? What does seems possible is that they have copied them from say a network drive to a local drive, and that has given the file a new creation date.
Neither letter arrived by snail-mail.
Last edited by airborne_artist; 26th January 2010 at 11:20.
Joined: May 2001
Posts: 10,804
Likes: 1
It could be a document control system in action.
Each different type works in slightly different ways, its not outside the realms of possibilty that it would recreate the document from the database instead of copying the original one.
Each different type works in slightly different ways, its not outside the realms of possibilty that it would recreate the document from the database instead of copying the original one.
